c2f3d18efcf4ea6eff42a09694f9d644beea5f7a34136d762f3da7096c55a6d8

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
04/01/2024, 15:17

Target

41330346f7be0725aa2c833d615660ad.dll
Size

19KB
MD5

41330346f7be0725aa2c833d615660ad
SHA1

20f1f6bd827d9730541fa3b8852cb74453c079ef
SHA256

c2f3d18efcf4ea6eff42a09694f9d644beea5f7a34136d762f3da7096c55a6d8
SHA512

ffa81c3bd18aba8cac47ded18ede41e5033b9f8b1bb3061565e852dc3e6657b0f17793c6ac6df657a86d80c35a00b5fe8b37d6a3a11071091da1e0e30f2ecc22
SSDEEP

384:NtVcRdm+5Wm53SLSmKCCuBBQARQkfWxXzG:ifbWbSmKClBBQARQkfEX

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2176	1716	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1776 wrote to memory of 1716	1776	rundll32.exe	28
PID 1776 wrote to memory of 1716	1776	rundll32.exe	28
PID 1776 wrote to memory of 1716	1776	rundll32.exe	28
PID 1776 wrote to memory of 1716	1776	rundll32.exe	28
PID 1776 wrote to memory of 1716	1776	rundll32.exe	28
PID 1776 wrote to memory of 1716	1776	rundll32.exe	28
PID 1776 wrote to memory of 1716	1776	rundll32.exe	28
PID 1716 wrote to memory of 2176	1716	rundll32.exe	29
PID 1716 wrote to memory of 2176	1716	rundll32.exe	29
PID 1716 wrote to memory of 2176	1716	rundll32.exe	29
PID 1716 wrote to memory of 2176	1716	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\41330346f7be0725aa2c833d615660ad.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1776
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\41330346f7be0725aa2c833d615660ad.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1716
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1716 -s 224
    3⤵
    - Program crash
    PID:2176